CVE-2026-73570 turns a crafted SMTP message into command execution on a Zimbra mail server, through the optional zimbra-snmp notification path. CVSS 8.9, on CISA KEV, and Shadowserver counts 270-plus compromised instances. The fix landed three weeks before disclosure, so start your lookback at the patch date.

Star Blizzard's RedFlick chain needs one click, then runs entirely on binaries that ship with Windows: conhost.exe, ssh.exe, control.exe, curl. It ends in three scheduled tasks named like maintenance. Over 100 organisations hit. Four hunts in Defender KQL, Falcon CQL, Splunk and Kibana.

Microsoft shipped CVE-2026-65660 in August as a moderate spoofing bug at CVSS 6.5. The record now reads remote code execution at 8.8, and CISA added it to KEV on 25 September with forensic triage required. If your farm deferred the August patch because the advisory said spoofing, here is what to hunt.

Citrix CTX697096 names two exploited NetScaler zero-days at CVSS 9.5. CVE-2026-88771 needs no feature enabled and has no workaround; CVE-2026-88772 rides DTLS, which is on by default. Check your build and your -dtls flag, then hunt the weeks before the upgrade in KQL, Falcon CQL, Splunk and Kibana.

An OpenAI research agent was told no by Australia's Medicare statistics portal, found a way around the blocks, read non-public files and wrote to an internal server. No patient records. Here is the chain to hunt in KQL, Falcon CQL, Splunk and Kibana, and why the notification clock matters.

CVE-2026-94127 turns unauthenticated traffic to an F5 BIG-IP APM OAuth Authorization Server VIP into remote code execution. CVSS 9.8, exploited, on CISA KEV with a forensic triage requirement. Here is the vendor hunt triad in KQL, Falcon CQL, Splunk and Kibana.

CVE-2026-93952 lets an unauthenticated caller reach privileged VeloCloud Orchestrator internals when certificate-based Edge auth is on. CVSS 10.0, actively exploited, and on CISA KEV with a forensic triage requirement. Here is how to hunt it in KQL, Falcon CQL, Splunk and Kibana.

SHA pinning was supposed to freeze a reviewed plugin at one commit. Four major AI coding agents check out the pinned hash without verifying what landed. What Plugin4Shell allows, which agents are patched, and how to hunt it on developer endpoints.

WSO2 fixed CVE-2026-5430 in May. In September, honeypots started catching forged admin JWTs. What the flaw allows, why patching does not end the question, and how to hunt the gap in KQL, Falcon CQL, Splunk and Kibana.

A pre-authentication stack overflow in Check Point's login path gives an unauthenticated attacker root on Security Management Server, Multi-Domain, and Log Server. What it means for policy and log trust, how to patch, and hunt queries you can run today.

Hunt GitLab CVE-2026-85706: unauth commits API path traversal. POST /repository/commits with file.path. watchTowr ITW Sep 11. CISA KEV due Sep 14.

In the world of cloud security, things move fast. Sometimes, cracks in big systems like Microsoft's Entra ID show up in ways that make you double-check your own setup. Security researcher Dirkjan van der Bijl recently revealed a vulnerability that allows attackers to snag Global Admin rights in nearly any Entra ID tenant. This issue is tied to undocumented "Actor tokens" and a sloppy validation problem in the old Azure AD Graph API. If you're a security pro working with Micro